GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers

GitLab has released a security fix for a critical vulnerability in its self-hosted AI Gateway, tracked as CVE-2026-90970 with a CVSS score of 9.9. The bug lets a logged-in user with access to the Duo Agent Platform escape the prompt template sandbox through a specially crafted custom flow configuration, allowing arbitrary command execution on the gateway server. Only organizations running their own AI Gateway instance are affected—GitLab.com, GitLab Dedicated, and customers using GitLab-hosted gateways are not at risk. The issue is resolved in AI Gateway versions 19.2.4, 19.3.2, and 19.4.1, while releases from 18.1.6 through 19.1 remain exposed with no listed fix or workaround. CISA's assessment logged with the CVE record notes no known exploitation so far. The flaw was reported via HackerOne and echoes a similarly rated CVE-2026-1868 gateway bug GitLab patched in February, both stemming from the same template-engine weakness class (CWE-1336).